SynthID — Google DeepMind's Invisible AI Watermark Explained
SynthID is Google DeepMind's invisible watermarking system that embeds imperceptible signals into AI-generated images, text, audio, and video at the moment of creation. It is entirely separate from the visible Nano Banana star watermark on Gemini images — and it cannot be removed by the same methods. This guide covers everything: how it works across every media type, how to detect it, what it cannot do, and the honest answer on whether it can be bypassed.
What is SynthID?
SynthID is an invisible digital watermarking technology developed by Google DeepMind. It embeds an imperceptible signal directly into AI-generated content — images, text, audio, and video — at the exact moment the content is created. The watermark is not a visible logo, not a metadata tag attached to the file header, and not a separate layer that can be cropped out. It is woven into the content's own data structure.
The purpose is to create a verifiable trail of AI origin. When a piece of content is uploaded to a detection tool, the watermark can confirm whether it was produced by a Google AI system — even after common modifications like compression, cropping, filters, format conversion, or minor edits.
As of 2025, Google reports that SynthID has watermarked over 10 billion pieces of content across images (Imagen), text (Gemini), audio (Lyria), and video (Veo). It is the most widely deployed invisible AI watermarking system in existence.
SynthID is not the same as the Gemini Nano Banana watermark
This distinction matters and causes the most confusion. When you generate an image in Gemini, you get two completely separate watermarking systems applied to your file:
| Nano Banana star (visible) | SynthID (invisible) | |
|---|---|---|
| What it is | Semi-transparent four-point star logo in the bottom-right corner | Imperceptible signal woven into pixel values and frequency data |
| How it's applied | Alpha compositing — a fixed, mathematical formula | Neural network embedding during generation |
| Visible to the eye? | Yes — clearly visible | No — completely invisible |
| Can be removed precisely? | Yes — via reverse alpha compositing | No — not without degrading image quality |
| Survives compression? | No — pixel values change | Yes — designed to survive JPEG, cropping, filters |
| Present on all Gemini images? | Free tier only (visible star) | All images, all tiers, always |
The Gemini Watermark Remover on this site uses reverse alpha compositing to remove the visible Nano Banana star. That method has no effect on SynthID whatsoever — they operate at entirely different technical layers.
How does SynthID work? The technology by media type
SynthID uses different technical mechanisms depending on the type of content being watermarked. The core principle is consistent — embed information in ways that are imperceptible to humans but detectable by specialized algorithms — but the engineering is entirely different for each medium.
Pixel-level neural embedding
Two deep learning models — one for embedding, one for detection — are trained together on a diverse image set. The embedder makes subtle modifications to specific pixel values and frequency components that fall below the threshold of human perception. The pattern is distributed redundantly across the entire image, not concentrated in one area.
Token probability adjustment
Large language models generate text token by token, each assigned a probability score. SynthID Text uses a technique called tournament sampling, adjusting these probability scores using a pseudo-random g-function so that certain token choices create a detectable statistical pattern — invisible in normal reading but verifiable algorithmically.
Psychoacoustic frequency embedding
SynthID converts the audio waveform into a spectrogram and embeds watermark signals in frequency ranges where the human ear is less sensitive. The audio implementation is designed to persist even when played through speakers and re-recorded, compressed as MP3, or subjected to noise addition — addressing the "analog hole" problem.
Frame-level temporal watermarking
Each frame in AI-generated video receives individual watermarking using the same image approach, but designed to remain consistent across frame rate changes, video compression codecs, and other modifications common in video distribution pipelines. Applied automatically by Veo, Google's video generation model.
How SynthID image watermarking works technically
For images, SynthID employs a two-component deep learning system. The embedder integrates the watermark during content generation — not as a post-processing step — which is why it achieves deep integration rather than surface-level application. The combined model is optimized for two competing objectives simultaneously: correctly identifying watermarked content, and maintaining imperceptibility by visually aligning the watermark to the original content.
The watermark signal is spread across the full image in a pattern that mirrors spread-spectrum communication technology — the same principle used in secure radio and GPS signals. This distribution is what makes it resistant to cropping: removing a corner of the image removes only a fraction of the redundant watermark signal, not the entire pattern.
How SynthID text watermarking works (tournament sampling)
SynthID Text operates at the token generation level. The core algorithm uses a pseudo-random function called a g-function that assigns each possible next token to either a "green" or "red" group based on the preceding context. During watermarked generation, green tokens receive a slight probability boost. The resulting text looks and reads normally, but statistically favors a detectable pattern of token choices.
Detection works by analysing the statistical distribution of green-token choices across the text. A high enough green-token ratio signals watermark presence. The Bayesian detector is more powerful but requires training; the simpler Weighted Mean detector requires no training and works across texts of varying lengths.
Watermark detection confidence drops significantly when AI-generated text is thoroughly rewritten, translated to another language and back, or heavily paraphrased. Google's own documentation acknowledges this. The system raises the cost of misuse but is not an absolute barrier against a motivated actor.
What is SynthID in Gemini?
Within Gemini specifically, SynthID operates as two parallel systems depending on what type of content you are generating.
For images generated by the Nano Banana model (Gemini's image generator), SynthID embeds an invisible frequency-domain watermark into every pixel-level output, regardless of subscription tier, image size, or how you access the API. This is entirely separate from the visible Nano Banana star that appears only on free-tier downloads.
For text generated through the Gemini app and web experience, SynthID Text applies token-level watermarking to the output. Notably, Google has confirmed that SynthID Text is active in the Gemini consumer app and web interface, but is not applied through the Gemini API — meaning text generated programmatically via the API does not carry SynthID Text watermarks.
The practical implication: if you generate an image in Gemini and remove the visible Nano Banana star using this tool, your image is still watermark-free to the human eye and usable for professional purposes — but the SynthID frequency signal remains embedded in the pixel data. A detection tool can still identify the image as AI-generated.
Is SynthID open source?
Partially. SynthID Text was open-sourced in October 2024 through Google DeepMind's GitHub repository and integrated into Hugging Face Transformers (v4.46.0). Developers can apply SynthID Text watermarks to any LLM's output using a logits processor, and train detection models using either the Weighted Mean or Bayesian approach. The reference implementation supports Gemma and GPT-2 models and is available under an Apache 2.0 license.
SynthID for images, audio, and video is not open source. The embedding and detection models are proprietary to Google DeepMind. The Nature paper published in October 2024 provides the theoretical basis for the text watermarking approach, but the image neural network architecture and trained weights are not publicly available.
SynthID Text is available via pip install synthid-text and through the Hugging Face Transformers model.generate() API with a SynthIDTextWatermarkingConfig parameter. The Google DeepMind GitHub at github.com/google-deepmind/synthid-text contains the reference implementation. This is not intended for production use without additional hardening.
How to detect a SynthID watermark — the SynthID Checker
The SynthID watermark is completely invisible to the human eye. There is no visual difference between a watermarked and non-watermarked AI image. Detection requires a specialized algorithm.
SynthID Detector portal
Google released the unified SynthID Detector portal in May 2025. The portal provides detection across all four media types — images, text, audio, and video — in one interface. It highlights which specific areas of an image are most likely to carry the watermark signal, and for audio, pinpoints segments where watermarking is detected.
Access is currently available to journalists, media professionals, and researchers through a waitlist at the SynthID Detector portal. A broader public rollout is in progress.
Detection via Gemini directly
You can upload an image, video, or audio clip to Gemini and ask directly: "Has this been created or altered by Google AI?" Gemini checks for a SynthID watermark and reports whether it finds one. This is the simplest check for casual users.
What detection actually outputs — three states, not two
SynthID detection does not return a simple yes/no. It outputs one of three confidence states:
| Detection result | What it means | Action |
|---|---|---|
| Watermark detected | High confidence the content was generated by a Google AI system | Content is reliably identifiable as AI-generated by Google |
| Uncertain | Some watermark signal present but below confidence threshold — could be degraded by edits | Content may have been modified after generation; treat with caution |
| No watermark detected | No SynthID signal found — content is either not from Google AI, or the watermark has been degraded beyond detection threshold | Does not confirm content is human-made; it only confirms no SynthID present |
SynthID only checks for its own signature. A "no watermark detected" result does not mean an image is human-made — it means it was not watermarked with SynthID. Images from Midjourney, DALL-E, Stable Diffusion, or any non-Google system will all return "no watermark detected." SynthID operates on a signed vs. unsigned model, not a real vs. fake model.
Can SynthID be removed?
This is the most searched question about SynthID, and the honest answer has two parts: technically, it can be degraded; practically, it cannot be cleanly removed without destroying image quality.
Why SynthID is fundamentally different from removing the Nano Banana star
The Nano Banana visible watermark can be removed precisely because it was applied using a fixed, known mathematical formula (alpha compositing). Given the formula and the opacity values, the original pixels can be recovered mathematically. This is what the Gemini Watermark Remover tool does.
SynthID images watermarking works completely differently. The signal is:
- Distributed redundantly across the entire image — not concentrated in a corner or region
- Embedded using a neural network with proprietary weights that are not public
- Not a separate layer — it is woven into the pixel values themselves across multiple frequency channels
- Designed specifically to survive the edits most people try first: JPEG compression, cropping, filtering, format conversion
Because of this architecture, there is no reverse formula equivalent to what works for the visible star. You cannot mathematically invert the embedding without knowing the original neural network's weights and the specific generation keys — which are private.
What bypass research actually shows
Multiple research projects have explored SynthID bypass, and their results are instructive precisely because of where they fail. The most documented approach uses diffusion model re-rendering: the original image is fed through a ComfyUI pipeline with a low denoising factor (around 0.2), using ControlNet edge maps to preserve composition while re-sampling enough of the pixel data to disrupt the watermark pattern.
The result is not clean removal. It is watermark degradation: the detection confidence drops from high to uncertain or undetected — but the image has also been visually altered in ways that are difficult to control at portrait regions, texture boundaries, and fine detail areas. One well-documented research project reported achieving a roughly 16% true evasion rate on their best attempt (V3 spectral bypass) after weeks of work, 123,000 image pairs, and a custom GPU-intensive pipeline. Google's own position is consistent with this: SynthID is not described as unbreakable, but as raising the cost of misuse high enough that most actors do not attempt it.
Effective SynthID bypass and image quality exist on opposite ends of a spectrum. The more successfully the watermark signal is disrupted, the more pixel-level changes are required — and the more those changes accumulate into visible artifacts at faces, textures, and gradients. Claims of "perfect removal with zero quality loss" are not technically possible given how SynthID embeds. Test results using the SynthID Detector portal confirm this pattern across all documented approaches.
What about SynthID Text removal?
SynthID Text is more vulnerable to degradation than image watermarking. Research has confirmed that translation attacks — running AI-generated text through one language and back using a non-Google model — drop watermark intensity toward zero. This is acknowledged in Google's own limitations documentation and confirmed by an ACL paper on cross-lingual watermark consistency. Heavy paraphrasing by a second LLM achieves similar results. The text watermark is a probabilistic fingerprint, not a cryptographic signature, and linguistic transformation disrupts the statistical patterns it relies on.
Is it illegal to remove AI watermarks?
The legal landscape is actively developing, and the answer depends on jurisdiction, intent, and what you do with the content afterwards.
United States — DMCA and the COPIED Act
DMCA Section 1202 protects copyright management information (CMI), including digital watermarks. Intentionally removing CMI to enable copyright infringement can result in civil penalties of up to $25,000 per violation and criminal prosecution for willful violations.
The COPIED Act (2024) specifically criminalizes removal of AI content watermarks when the intent is to deceive or defraud — particularly in contexts involving electoral manipulation, fraud, or impersonation. The law includes carve-outs for personal use and research not intended to deceive. Enforcement has focused on commercial operations and organized disinformation campaigns rather than individuals experimenting with their own content.
European Union — EU AI Act
The EU AI Act requires transparency for AI-generated content in high-risk contexts. While it does not specifically criminalize watermark removal, commercial use of de-watermarked AI content in advertising, news media, or political communications may face regulatory scrutiny. The Act's transparency requirements are legally binding from 2025 onwards in applicable contexts.
Practical position for most users
Attempting to remove SynthID almost certainly violates Google's Terms of Service, which prohibits circumventing content authenticity mechanisms. Consequences can include account suspension and loss of access to Google services. For content you generated yourself using tools you pay for, the legal risk is lower — but the ToS risk is real. The more important consideration for most users is that the SynthID signal does not restrict your ability to use, publish, or commercialise the image. It identifies origin; it does not impose a rights restriction.
The legal analysis above applies to your own AI-generated content. Removing visible or invisible watermarks from copyrighted images you do not own — such as stock photos from Getty Images or Adobe Stock — is clearly prohibited under DMCA Section 1202 regardless of whether AI was involved in creating them.
Is SynthID accurate?
SynthID's accuracy depends heavily on what modifications the content has undergone. Google's internal testing shows strong performance against common modifications, but the system has documented failure modes.
| Modification type | SynthID image detection | SynthID text detection |
|---|---|---|
| JPEG compression | Survives — designed to persist | N/A |
| Cropping a portion | Survives — signal is distributed | Degrades proportionally to text removed |
| Adding filters / colour adjustments | Survives minor adjustments | N/A |
| Format conversion (PNG→WebP→JPEG) | Survives | N/A |
| Screenshot of screen | May degrade — rescaling affects signal | N/A |
| Diffusion model re-rendering | Degrades significantly — image quality also degrades | N/A |
| Paraphrasing / rewriting | N/A | Degrades proportionally to extent of rewrite |
| Translation to another language and back | N/A | Drops watermark intensity toward zero |
| Social platform re-encoding | Uncertain — platforms apply variable compression | N/A |
SynthID timeline — from launch to today
SynthID announced for images
Beta launched in partnership with Google Cloud for Vertex AI customers using Imagen. Image watermarking only. Closed access.
SynthID expanded to audio
Audio watermarking added for Lyria, Google's AI music generation model, and the NotebookLM podcast generation feature.
SynthID Text open-sourced — Nature publication
SynthID Text open-sourced through Google's Responsible GenAI Toolkit and integrated into Hugging Face Transformers v4.46.0. Research paper published in Nature journal.
Unified SynthID Detector launched
Single verification portal for images, text, audio, and video. Initial rollout to journalists, media professionals, and researchers via waitlist.
Global rollout alongside Gemini 3 Pro
Unified SynthID Detector rolled out globally. Users can verify watermarked content directly through Gemini's ecosystem. Over 10 billion pieces of content watermarked to date.
How to tell if a picture is AI-generated
SynthID is the most reliable method for identifying Google AI images, but it is not the only signal. A complete approach uses multiple layers.
Method 1 — SynthID Detector (most reliable for Google AI content)
Upload the image to the SynthID Detector portal or to Gemini directly. Ask whether it contains a SynthID watermark. If detected, the image was generated by Google AI. If not detected, this does not rule out AI generation — it only rules out Google SynthID.
Method 2 — C2PA content credentials
Many AI generators (Midjourney, DALL-E, Adobe Firefly, Gemini) embed C2PA cryptographic metadata into image files, which platforms like Instagram and LinkedIn read to display "Made with AI" labels. Use the AI Metadata Scrubber on this site to inspect — upload an image and the tool reveals what C2PA and AI metadata is present before stripping it.
Method 3 — Visual inspection signals
No method is fully reliable, but common AI image artifacts include: hands with incorrect finger counts or merged digits, text that is distorted or non-readable, background repetition or unnatural symmetry, teeth and hair that have an overly smooth or plastic quality, lighting that does not match between the subject and environment, and ear geometry that doesn't match.
Method 4 — Google's "About This Image"
In Google Search, the "About This Image" feature (accessed via the three-dot menu on image results) can sometimes surface SynthID signals and C2PA metadata for images indexed by Google. Availability is inconsistent but improving.
SynthID vs C2PA vs Nano Banana — the three layers compared
Gemini images can carry all three watermarking mechanisms simultaneously, and they serve entirely different purposes. Understanding the distinction prevents the most common mistake: removing the visible star and assuming the image is now unidentifiable as AI-generated.
| Nano Banana star | C2PA credential | SynthID | |
|---|---|---|---|
| Type | Visible graphic overlay | Invisible cryptographic metadata | Invisible frequency signal |
| Where it lives | Pixel layer (alpha-composited) | File header / JUMBF container | Pixel frequency data (all channels) |
| Triggers "Made with AI" labels? | No | Yes — Instagram, LinkedIn, Pinterest read this | No — not read by platforms for labelling |
| Detectable by? | Human eye | Platform algorithms, metadata readers, AI Metadata Scrubber | SynthID Detector, Gemini |
| Can be removed? | Yes — precisely, using reverse alpha compositing | Yes — using AI Metadata Scrubber | Not cleanly — only degraded with quality loss |
| Survives screenshot? | Yes (visible) | No — metadata stripped | Partially — depends on rescaling |
| Tool on this site | Gemini Watermark Remover AI | AI Metadata Scrubber | Cannot remove — explained on this page |